Can't use to sign SSH key: CKR_KEY_FUNCTION_NOT_PERMITTED

[3rdcycle]

Hi

I tried to use this library on a Mac to sign SSH keys with a Yubikey 5. This does not seem to work:

$ ssh-keygen -I user@example.org -s ca.pub -D /usr/local/lib/keychain-pkcs11.dylib -n user -V +1d .ssh/id_rsa.pub
C_SignInit failed: 104
pkcs11_get_key failed
Couldn't certify key .ssh/id_rsa.pub: error in libcrypto

Is this an issue with the library or the hardware key?

[kenh]

Is it an elliptical curve key on the YubiKey? Right now keychain-pkcs11 only supports RSA, but this could be the forcing function that makes me finally add EC support.

BTW, the debug logging from keychain-pkcs11 should give you some idea what is going wrong (the errors you can return from a PKCS#11 library are very limited). See keychain-pkcs11(8) for the details on how to look at that.